1.2.1. 💡 First Principle: Defense-in-Depth

First Principle: Defense-in-Depth fundamentally applies multiple, overlapping layers of security controls to protect resources from unauthorized access, malicious attacks, and data exfiltration.

Defense-in-Depth is a security strategy where multiple layers of security controls are placed throughout an IT system. The idea is that if one security control fails, another layer is there to protect. It's like having multiple locks on a door.

Key Characteristics of Defense-in-Depth:

• Layered Security: No single security control is foolproof. Redundant controls enhance overall security.
• Overlapping Controls: Different security mechanisms cover each other's weaknesses.
• Multiple Vectors: Addresses various attack vectors at different points in the system.

AWS Implementation Examples:

• Network Layer: VPC isolation, Network ACLs (NACLs) (subnet firewall), Security Groups (SGs) (instance firewall).
• Perimeter Protection: AWS WAF (web application firewall), AWS Shield (DDoS protection), AWS Network Firewall.
• Compute Layer: OS hardening, patching, anti-malware.
• Application Layer: Secure coding practices, input validation, API Gateway authorization.
• Data Layer: Encryption (at rest and in transit), access controls (IAM).
• Identity Layer: Multi-Factor Authentication (MFA), least privilege.
• Monitoring & Logging: CloudTrail, CloudWatch, GuardDuty at all layers.

Scenario: You need to design the security for a public-facing web application that handles sensitive data. You want to implement multiple layers of security to protect against various threats, including network attacks, web exploits, and unauthorized data access.

Reflection Question: How does applying a "Defense-in-Depth" strategy, by implementing multiple, overlapping layers of security controls (e.g., Security Groups, AWS WAF, encryption), fundamentally protect resources and minimize the impact if one security control fails?

💡 Tip: Think of Defense-in-Depth as a cybersecurity onion: each layer provides protection, and an attacker must peel away one layer at a time.